Authent XML ++

Aif4thah · May 20, 2024 · 6c0c7ce · 6c0c7ce
1 parent 1c4cd90
commit 6c0c7ce
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/Controller/Controller.cs b/Controller/Controller.cs
@@ -82,11 +82,12 @@ On enregistre les objets "employé" valides dans un fichier en lecture seule
             return Results.Ok($"File is : {File.GetAttributes(ROFile).ToString()}    New id : {NewId}    Empty Var: {HaveToBeEmpty.IsNullOrEmpty()}");
         }
 
-        public static string VulnerableXmlParser(string Xml)
+        public static string VulnerableXmlParser(string Xml, string Token, string Secret)
         {
             /*
             Parse les données XML passées en paramètre et retourne son contenu
             */
+            if (!VulnerableValidateToken(Token, Secret)) return Results.Unauthorized().ToString();
             try
             {
                 var Xsl = XDocument.Parse(Xml);
@@ -103,7 +104,6 @@ Parse les données XML passées en paramètre et retourne son contenu
             }
             catch (Exception ex)
             {
-                Xml = Xml.Replace("Framework", "").Replace("Token", "").Replace("Cmd", "").Replace("powershell", "").Replace("http", "");
                 XmlReaderSettings ReaderSettings = new XmlReaderSettings();
                 ReaderSettings.DtdProcessing = DtdProcessing.Parse;
                 ReaderSettings.XmlResolver = new XmlUrlResolver();

diff --git a/Program.cs b/Program.cs
@@ -48,7 +48,7 @@
 
 app.MapGet("/", async (string? lang) => await Task.FromResult(VLAController.VulnerableHelloWorld(HttpUtility.UrlDecode(lang)))).WithOpenApi();
 
-app.MapGet("/Xml", async (string i) => await Task.FromResult(VLAController.VulnerableXmlParser(HttpUtility.UrlDecode(i)))).WithOpenApi();
+app.MapGet("/Xml", async (string i, string t) => await Task.FromResult(VLAController.VulnerableXmlParser(HttpUtility.UrlDecode(i), t, Secret))).WithOpenApi();
 
 app.MapGet("/Json", async (string i, string t) => await Task.FromResult(VLAController.VulnerableDeserialize(HttpUtility.UrlDecode(i), t, Secret))).WithOpenApi();